Corelight Threat Intelligence is a threat intelligence platform integrated into the Corelight Open NDR Platform. The product combines threat intelligence indicators of compromise (IOCs) from CrowdStrike with network detection and response capabilities to identify known and unknown threats. The platform provides hourly updates of curated, high-confidence IOCs that can be applied to both real-time and historical network data. It validates IOCs against network evidence to confirm threats and reduce false positives from low-fidelity intelligence feeds. The system enriches IOCs with adversary attribution, related malware, targeting information, and associated vulnerabilities to help prioritize alerts. The product supports multi-layered detection strategies including AI/ML-based detection, anomaly detection, behavioral detection, and signature-based detection. Threat hunters can query historical network evidence with real-time IOCs to identify vulnerable systems and previously undetected threats. Alerts generated by the platform can be integrated into existing SIEM, SOAR, and XDR solutions. The system aims to reduce alert fatigue by minimizing low-quality alerts and streamlining threat detection workflows for security operations center teams.